On this system, there is only one user allowed, and that's me. On one of my other systems, where two, but both good security guys. I run a bash script every night to grep the successful and unsuccessful logins every night that is mailed to me, that's how I spot these things quick. Also Denyhosts emails me for every Deny.
Gary Baribault Courriel: [email protected] GPG Key: 0x685430d1 Signature: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1 On 06/17/2010 10:56 AM, Michael Holstein wrote: > >> Is anyone else seeing this type of attack? Or is someone really >> targeting MY box? >> >> > > No, I assure you it's not just you. > > It's also not uncommon to see a sequential (basically a nmap -p 22) scan > at full throttle several times a day. > > You can basically : > > a) move to another port (obscurity .. but pretty effective in weeding > out the casual versus committed) > b) switch to public key only auth (recommended anyway if possible). > c) use denyhosts, tarpitting, etc. to frustrate the casual guessers and > bots. > > The ones that are committed will find a way around (a) and (c). But it > will take somebody a long time to properly guess a key for (b) .. > unless you forgot to patch your Debian SSHd from their little snafu .. > but you'd have been owned long ago if that was the case. > > If you really must use passwords on a multi-user system listening on > tcp/22, then employ something like the PAM modules for JTR > (/pam_passwdqc) /just to make sure people don't use stupid ones. > > Cheers, > > Michael Holstein > Cleveland State University >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
